Help me beat server script that strips doctype and comments

Forum Moderators: open

Message Too Old, No Replies

Help me beat server script that strips doctype and comments

I need to find a way to beat this so I can

illtron

8:38 pm on Dec 20, 2006 (gmt 0)

Here's my dilemma: My employer uses a proprietary Apache module with a server-side regex process to strip comments. Their include system closely resembles comments, so to speed up page serving, they strip them out. In the process they strip out doctypes.

My problem is that I need a doctype to do some stuff. It'll be a cold day in hell before they change this behavior, so in the mean time, I'm trying to find a way to beat this. Does anybody have any ideas on how I might do this? I don't have any specifics on how they strip the tags, but I was thinking hex-encoded text or something along those lines. I'm not really sure how I'd even do that.

If you can give any advice, it would be very helpful.

Thanks!

eelixduppy

8:43 pm on Dec 20, 2006 (gmt 0)

Before trying to "beat the system" you should talk to your employer about the issue to see what he/she can do. If you have a ligament reason for including doctypes then your employer shouldn't have a problem with coming to a solution for you.

illtron

8:46 pm on Dec 20, 2006 (gmt 0)

It won't happen anytime soon. We've tried. The Apache module was written like 10 years ago with an update like 7 years ago, and the people who worked on it aren't here anymore. Like pretty much everything around here, it's poorly documented.

This is really part of a bigger project I'm working on to convince them that fixing this would be worth the trouble.

encyclo

8:55 pm on Dec 20, 2006 (gmt 0)

They may be filtering on

[b]<![/b]

- which would be a challenge to overcome. Are you able to test whether a very simple doctype such as

<!DOCTYPE HTML>

is filtered?

illtron

9:06 pm on Dec 20, 2006 (gmt 0)

<!DOCTYPE HTML>

Gives me

<!OCTYPE HTML>

It looks like using an XHTML 1.0 Strict Doctype gives me this:

<!OCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

IE 7 chokes with that, but Firefox has no problems. Hmm...

eelixduppy

9:08 pm on Dec 20, 2006 (gmt 0)

Not sure what their filtering method is from this. Have you tried

<!DDOCTYPE HTML>

;)

encyclo

9:09 pm on Dec 20, 2006 (gmt 0)

<!OCTYPE HTML>

So what does

<![b]DD[/b]OCTYPE HTML>

do?

added: too slow!

illtron

9:16 pm on Dec 20, 2006 (gmt 0)

Holy crap, it works!

Who would have thought that it would be so simple? I'm still pretty certain that something will break sooner or later. I'll keep you posted. Thanks!

eelixduppy

9:18 pm on Dec 20, 2006 (gmt 0)

Now I know why those employees that worked on it don't work there anymore ;)

Glad you got it sorted.

...and sorry for stealing your thunder encyclo :)